The vulnerability CVE-2025-24677 affects the wpspin Post/Page Copying Tool plugin for WordPress, specifically versions up to 2.0.3. It is an improper control of code generation vulnerability classified as code injection, allowing remote code inclusion. This means an attacker with low privileges can inject and execute arbitrary code remotely without requiring user interaction, potentially compromising the affected system fully. The CVSS 3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could lead to full system compromise, including unauthorized disclosure of information, modification of data, and denial of service. Because the vulnerability allows remote code execution with low privileges and no user interaction, it poses a critical risk to affected installations of the wpspin Post/Page Copying Tool plugin. There are no known active exploits reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to limit exposure by restricting access to the affected plugin functionality and monitoring for suspicious activity related to the plugin. Avoid using affected versions of the plugin in production environments if possible.